Windows hit by 'extremely critical' zero-day flaw

The flaw affects a part of the Microsoft XML Core Services 4.0

Microsoft has issued a warning about a new exploit in all Windows versions except Windows 2003 that is actively being exploited by attackers. 

The flaw affects a part of the Microsoft XML Core Services 4.0, referred to as the XMLHTTP 4.0 ActiveX Control. 

The Core Service technology provides interoperability between applications based on the XML 1.0 standard and Microsoft's Jscript, VBScript and Visual Studio 6.0 programming environments.

Attackers could exploit the flaw to take control of a system by luring victims to a specially crafted website or a page on a social service such as MySpace.

Microsoft said that it is aware of "limited attacks" exploiting the flaw, but did not provide a security rating.

Security website Secunia issued an advisory giving the vulnerability its most severe rating of 'extremely critical'. 

Alex Eckelberry, a president with security vendor Sunbelt Software, downplayed the threat. The company has detected only one site exploiting the flaw so far, and claimed that the exploit was poorly engineered.

"This is a pretty crappy exploit in that it doesn't work all that well," wrote Eckelberry on his blog. 

Microsoft is currently investigation the flaw. The company will decide whether a security update is released as part of its patch cycle on the second Tuesday of each month or as an out-of-cycle update.

• Microsoft Security Advisory (927892)